MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 42de2be8dd54f0733138e13af44653c7acf129ab0acc376d89a18b2b8a69101e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 42de2be8dd54f0733138e13af44653c7acf129ab0acc376d89a18b2b8a69101e
SHA3-384 hash: f29a09c9331d852e5e76a2cd326989570266b01b1994d1ca6fb99dc9b598bb6978e0fb89767e7d633745ba1d3756581a
SHA1 hash: cfa0028bb78e1b0f51d4d389947319dd7beb10d5
MD5 hash: 1614d9adfb1903a189e6efd9b6dc4077
humanhash: golf-white-fifteen-ink
File name:1614d9adfb1903a189e6efd9b6dc4077
Download: download sample
File size:1'413'632 bytes
First seen:2021-10-24 07:44:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a760781485268ad462242975d68411d5
ssdeep 24576:P/mj8gr6siw8y8KbE0N4TMAeulQI1N6y83bMJb2dtGulJe:POjH7iby84E0aTrlQcNkbYidv
Threatray 82 similar samples on MalwareBazaar
TLSH T174657D4AA3A901E8D0ABD278CA52950BE7B17C0103709BDF17D95B5A1F23FE05E7E721
Reporter zbetcheckin
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
465
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
setup_x86_x64_install.bin
Verdict:
Malicious activity
Analysis date:
2021-10-23 20:08:28 UTC
Tags:
trojan evasion rat redline loader opendir stealer vidar raccoon unwanted netsupport danabot
Link:
https://app.any.run/tasks/e56167fe-fed4-40dd-8de4-611e66bda733

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/199631/
Detection(s):
Win.Malware.Spyagent-9830839-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Connection attempt
Sending an HTTP GET request
Reading critical registry keys
Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/617512239a5a1e91c5d20173/reports/164eb1c7-6337-46c9-8a71-1db44dd26202/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ecd1dd07-e338-4f20-a74b-ad52164fc257
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.spyw
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/875773
Signature
May check the online IP address of the machine
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/42de2be8dd54f0733138e13af44653c7acf129ab0acc376d89a18b2b8a69101e/
Threat name:
Win64.Trojan.Fabookie
Create hunting rule
Status:
Malicious
First seen:
2021-10-21 14:48:06 UTC
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
2a95ce43c87b8a26be71a459eae796a572422bd99cf0b9a3580a3a68e7dbd1a2
4cd754af5d3b9faa7e9626f79fccc35464224247a10f4d01ef502a0423e637a7
55944c6ffe4959032363fb52da47741b8e6464cf05b7718462112ddd9d506f5e
8f8042ea48aa01dd010aede41cbfe28ba2741a9c0bc7b5c7b55d38e1ab3b5027
b22ea99c132ab236e3a9bcc4d42b9038badaaa85c14edfee535e21f7d46436a1
c03c8a4852301c1c54ed27ef130d0de4cdfb98584adef3dda2a096177016a18b
ccfd37710068b3998537ac325e29555ba9375ebf1230cf90e9dcf133e06bcdf3
d7b0380241e4d47fc00e72faa08831b51b0ae360d5ccc45717f39f3106c3020a
eae36eba857fac64d7b10f7055df67010c65bdf968734007462a9d6e2bdae47c
fd4d1fc83330c5cf818e557ef882ca147ba98fee4128fe00bda07c6c2f79050a
+ 72 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
spyware stealer
Link:
https://tria.ge/reports/211024-jld72sddh2/
Behaviour
Looks up external IP address via web service
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
42de2be8dd54f0733138e13af44653c7acf129ab0acc376d89a18b2b8a69101e
MD5 hash:
1614d9adfb1903a189e6efd9b6dc4077
SHA1 hash:
cfa0028bb78e1b0f51d4d389947319dd7beb10d5
Link:
https://www.unpac.me/results/e7fabe6e-2375-43c0-a9b9-9507090e17de/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/42de2be8dd54f0733138e13af44653c7acf129ab0acc376d89a18b2b8a69101e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 42de2be8dd54f0733138e13af44653c7acf129ab0acc376d89a18b2b8a69101e

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/199631/

Comments


Avatar
zbet commented on 2021-10-24 07:44:43 UTC

url : hxxp://file.ekkggr3.com/lqosko/p18j/cust51.exe